PoolParty

PoolParty is a collection of process injection techniques targeting Windows Thread Pools. It was originally researched and released by SafeBreach Labs, including a C++ proof-of-concept, and later reimplemented in C# as the red-team tool SharpParty by Stroz Friedberg/LevelBlue. The technique works by crafting and inserting legitimate-looking work items into a target process’s thread pool to execute injected code, rather than relying on more commonly monitored methods such as CreateRemoteThread. The content states that PoolParty was designed to evade endpoint detection and response systems and that SafeBreach reported bypassing five leading EDR vendors. It targets Windows systems and is associated in the content with offensive security research and red-team tradecraft rather than a named threat actor. Reported delivery and execution methods for the C# implementation include inline MSBuild tasks executed by msbuild.exe and reflective in-memory loading via PowerShell. In one described engagement, encrypted SharpParty code was embedded in an MSBuild Task XML, used HTTP keying to retrieve and validate a decryption key, and ultimately delivered a Cobalt Strike beacon; persistence was tested via a registry Run key. The content also states that Microsoft Defender for Endpoint initially failed to detect the technique, that Microsoft validated a bypass report in March 2025 and later added detections, and that other EDR products may now detect it based on suspicious msbuild.exe usage and process injection behavior. High-confidence indicators and artifacts mentioned in the content include use of Windows Thread Pool injection, msbuild.exe, PowerShell reflective assembly loading, registry Run key persistence, and delivery of a Cobalt Strike beacon.